add Brainpool curves

[warner]

Zooko points out that many folks don't like the NIST curves because they don't come with a proof of being generated randomly. The Brainpool curves do. http://cryptopp.svn.sourceforge.net/viewvc/cryptopp/trunk/c5/eccrypto.cpp?r1=441&r2=440&pathrev=441 and http://cryptopp.svn.sourceforge.net/viewvc/cryptopp/trunk/c5/oids.h?r1=441&r2=440&pathrev=441 are where Brainpool support was added to Crypto++.

If OpenSSL supports these curves (so we can do interop testing), I'm happy to add them to python-ecdsa.

[warner]

http://tools.ietf.org/rfc/rfc5639.txt has the curve parameters. I don't see any evidence of these curves in OpenSSL.

[zooko]

There are two patches that have been submitted to openssl to add Brainpool curves to OpenSSL:

http://rt.openssl.org/Ticket/Display.html?id=2239&user=guest&pass=guest

and

http://rt.openssl.org/Ticket/Display.html?id=2359&user=guest&pass=guest

I wonder if it would help move that process along if we wrote some Known-Answer-Test patch to go into OpenSSL or otherwise contributed...

[zooko]

I really don't like "popularity contests" in general, but when choosing a crypto primitive, if there is a legitimate constituency that distrusts an option then that really is a good reason to prefer a different option. I don't want a significant base of potential future users to distrust Tahoe-LAFS because it relies on the NIST curves (even if the majority of potential future users trust the NIST curves).

What we're talking about here is basically geo-politics, I guess. People who trust NIST and NSA to be honest and/or to be on their side are fine with the NIST curves, but those people are also fine with the Brainpool curves. I don't want to exclude future user bases who distrust NIST and NSA. The first significant user base to go with the Brainpool curves is the German federal government, who sponsored the development of the Brainpool curves and are now deploying them.

Note that you do not have to trust the German federal government in the same way to be satisfied using the Brainpool curves! This is because they are generated with a specific PRNG using SHA-1, seeded with π.

http://tools.ietf.org/html/rfc5639

Note that upgrading to new curves in the future is a compatibility issue, but not as big of a compatibility issue as several of the other changes that we are planning in the Tahoe-LAFS project!

(Note this is a similar issue to why I want Tahoe-LAFS to continue using AES in addition to XSalsa20 even though I personally think that XSalsa20 is safer than AES. For people out there who disagree with me and think that AES is safer than any alternative, I don't want to reduce their trust in Tahoe-LAFS by using XSalsa20 alone.)

[ScottSturdivant]

Hi, as OpenSSL 1.0.2 (albeit in beta) now supports the brainpool curves, is it possible to get them added to this library? Thanks for the consideration!

[shrir]

Hi, I just came across this thread looking for brainpool curve support and ended up patching the curves. (patch attached here, if somebody is still interested; still need to test a few things...)
brainpool_r1.txt

[tomato42]

There definitely are people interested. And the patch looks good, only test cases are missing.

[tomato42]

fixed by #61